# CVE-2026-111246: Apache OpenEJB HTTP server session isolation vulnerability

Source: https://junglewise.ai/threats/cve-2026-111246-the-embedded-openejb-http-server-does-not-isolate-http-sessions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-111246 · Severity: info · Published 2026-11-10

The embedded HTTP server in Apache OpenEJB does not properly isolate HTTP sessions between different web applications. An attacker with network access can reuse a session from one application to gain access to another application running on the same server, potentially allowing unauthorized actions or data exposure if the second application trusts session state created by the first.

Technologies: [Apache OpenEJB](https://junglewise.ai/threats/technologies/openejb). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111246 being exploited in the wild.

**How severe is CVE-2026-111246?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Apache OpenEJB.

**Is there a fix for CVE-2026-111246?** No fixed version is recorded yet. Block network access to the embedded OpenEJB HTTP server from untrusted clients, or migrate to TomEE distributions which use Tomcat as the web container. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111246 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111246?** Check whether you run Apache OpenEJB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Block network access to the embedded OpenEJB HTTP server from untrusted clients, or migrate to TomEE distributions which use Tomcat as the web container.

## Technical details

The OpenEJB embedded HTTP server fails to enforce session isolation between co-hosted web applications, allowing a remote attacker to reuse an authenticated session across application boundaries. The vulnerability requires network access to the embedded HTTP server and affects only deployments hosting multiple web applications on the same embedded server instance. An attacker can escalate privileges or bypass authentication within a target application by leveraging a valid session from another application.

## Affected products

- Apache OpenEJB

## Timeline

- 2026-11-10: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39](https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39)

## Related threats

- [Apache OpenEJB embedded HTTP server privilege escalation via thread identity reuse](https://junglewise.ai/threats/cve-2026-97888-the-embedded-http-server-does-not-clear-the-security-identity)
- [Apache OpenEJB path traversal in HTTP server](https://junglewise.ai/threats/cve-2026-97881-the-embedded-openejb-http-server-does-not-restrict-static)
- [Apache OpenEJB HTTP server authentication bypass in REST endpoints](https://junglewise.ai/threats/cve-2026-97880-the-embedded-openejb-http-server-dispatches-some-requests-to-rest)
- [Apache OpenEJB HTTP server resource exhaustion](https://junglewise.ai/threats/cve-2026-86531-the-embedded-openejb-http-server-does-not-limit-the-size-of)
- [Apache OpenEJB authentication bypass in embedded HTTP server](https://junglewise.ai/threats/cve-2026-111256-when-jax-ws-or-jax-rs-endpoints-are-published-by-the-embedded)